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Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in the 

application. 
Listing of Claims : 

1. (Currently Amended) A method for collecting and analyzing first data on a first 
communication line comprising the steps of: 

(a) receiving the first data from the first communication line; 

(b) segregating the first data into packets; 

(c) selecting packets based on a respective first characteristic of each packet; 

(d) associating a respective index with each of the selected packets; 

(e) converting each of the selected packets into a respective record including its 
respective index; 

(f) storing the records; 

(g) stor i ng generating a count based on a respective second characteristic of each of the 
selected packets received during each of a plurality of successive periods. 

2. (Canceled). 

3. (Currently Amended) A method for co l lect i ng and ana l yz i ng first data transm i tted 
on o f i rst commun i cat i on l i ne comprising the steps of: 

(a) receiving the-first data from tbe-a_first communication line; 

(b) segregating the first data into packets; 

_ (c) se l ecting packets boscd on a respect i ve type of each packet; 

(d) assoc i ating a respect i ve i ndex with each of the selected packets; 

(c) convert i ng each of the se l ected packets into o respect i ve record i nclud i ng i ts 
respect i ve index; 

(f) stor i ng the records; 

(g) receiv i ng a first durat i on va l ue corresponding to a first time period; 

(he) generating at le ast one a_statistic corresponding to packets received during each of 
a plurality of successive first time periods , the first time periods having a first duration value : 
and 

(Id) separately storing the generated vo l uc of at l east one stat i stic statistics for each of 
the a -plurality of successive first time periods : and 

(e) generating a further statistic by aggregating the plurality of stored statistics . 

4. (Currently Amended) The method according to claim 3 further comprisingi 
selecting packets based on a respective type wherein the statistics generated in step (c) . 

correspond to the selected packets: 

associating a respective index with each packet: 

converting each packet into a respective record including each packet's respective index: 

and 

storing the records the stop of gencrot i ng a further stat i st i c using at l east one of the 
s tored records and the stored at l east one stat i st i c . 

5. (Currently Amended) The method according to claim 34 further comprising the 
steps of: 
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receiving a second duration value corresponding to a second time period longer than the 
first time period; and 

generating athe further statistic corresponding to packets received during the second 
time period encompassing at least one first time period using at least one of the stored records 
and the stored statistics corresponding to packets received during the second time perioda t 
least one statist i c . 

6. (Currently Amended) The method according to claim 3 wherein the at least ono 
statistic includes at least one of a number of bits, a number of bytes, a number of packets, a 
number of packets of a predetermined protocol, a number of packets of a predetermined 
protocol layer, a number of packets having a predetermined source address, and a number of 
packets having a predetermined destination address of a respective packet. 

7. (Currently Amended) The method according to claim -34 wherein a record includes 
a portion of Its -said record's respective packet plus Its -said packet's respective index. 

8. (Currently Amended) The method according to claim 3-4_wherein the respective 
index of a packet corresponds to a time when the packet was received. 

9. (Currently Amended) A method according to claim 8 further comprising the steps 
of receiving a time signal from a global positioning satellite i nd i cating an absolute time and 
generating the time when a -the packet was received based on the absolute time. > 

10. (Currently Amended) A method according to claim 3 wherein the received packets 
originated from a second communication line and each received packet includes an indication of 
a respective first time corresponding to Its-transmission of said packet on the second 
communication line, the method further comprising: 

determining a respective second time when each packet is received from the first 
communication line; and 

generat i ng calculating a transmission delay corresponding to each packet by subtracting 
Its -said packet's respective second time from Its -said packet's respective first time. 

11. (Currently Amended) A method according to claim 10 wherein the transmission 
delay corresponding to each packet is calculated based on a time the packet is detected on a 
the first Hn kcommunication line , a time the packet is detected on the a -second communication 
linelmk, a rate of data transmission on the first communication Iine4 4f^k, and a length of the 
packet on the first communication linel mk. 

12. (Original) The method according to claim 3 wherein step (a) includes receiving the 
first data from the first communication line using a non-intrusive coupling to the first 
communication line. 

13. (Currently Amended) The method according to claim 3-4_further comprising the 
step of receiving information indicating at least one of a type of packets to be selected i n step 
{e}, the first duration value, and an identification of which the statistics to generate in step (he). 

14. (Original) The method according to claim 13 wherein the information is received via 
the first communication line. 

15. (Canceled). 
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16. (Original) A method according to claim 10 including the step of receiving a time 
signal from a global positioning satellite for determining the second time. 

| 17. (Currently Amended) A method according to claim 3-4_wherein step {he) includes 

generating at least one quality of service value for each successive time period corresponding to 
packets of a predetermined packet type received during each respective successive time period. 

18. (Original) A method according to claim 17 wherein the at least one quality of service 
value indicates at least one of a round trip delay and a retransmit rate corresponding to the 
packets of the predetermined packet type received during the respective successive time 
period. 

19. (Currently Amended) A method according to claim 3 where i n step (c) i nc l udes 
comprising determining a respective type of each packet based on at least one of a 
corresponding application type, a corresponding packet content, a packet source, and a packet 

| destination for selecting packets based on the respective type . 

20. (Currently Amended) A method according to claim 3 wherein the first 

| communication line is in a network including a user and step (fcc) includes generating at least 
one user profiling statistic for each successive time period corresponding to packets destined to 
or from a user which are received during each respective successive time period. ! ^ ' : 

21. (Original) A method according to claim 20 wherein the at least one user profiling 
statistic is generated using the records stored in the memory. 

22. (Currently Amended) A method according to claim 3 further comprising the step 
of receiving an input from a user identifying a user statistic and step {he) includes generating 
the identified user statistic. 

23. (Currently Amended) A method according to claim 3 further comprising the steps 

of: 

receiving an input from a user identifying a user statistic; and 

generating the identified user statistic using at least one of the stored statistics and the 
stored records. 

24. (Original) A method according to claim 3 wherein the first data is transmitted on the 
first communication line according to a first protocol, the method further comprising the step of 
receiving decoding parameters corresponding to the first protocol and step (a) includes 
receiving the first data according to the decoding parameters and step (b) includes segregating 
the received first data into packets according to the decoding parameters. 

25. (Currently Amended) A method according to claim 3 where i n comprising: 
counting packets of each a plurality of packet types received during each of the 

successive first time periods; and step (h) inc l udes generat i ng a separate count for eoch of a 
plura li ty of pocket types corresponding to a number of packets of each respective one of the 
p l ura li ty of pocket types rece i ved during each respect i ve successive t i me period; and the 
method further comprises the step of 

displaying the plurality of packet types and their corresponding statistics counts 
accumulated over a second time period greater than the first time period in a first portion of a 
display area of a display device. 
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26. (Currently Amended) A method according to claim 25 wherein the plurality of 
packet types are selectable by a user and the method further comprises the steps of: receiving 
a user selection of one of the packet types by a user t and displaying statistics corresponding to 
packets of the selected packet type received during the second time period. 

27. (Original) A method according to claim 25 further comprising the step of graphically 
displaying the statistics corresponding to the plurality of packet types in a plot over the second 
time period in a second portion of the display area. 

28. (Original) A method according to claim 25 further comprising the step of: generating 
a graphical display of the statistics corresponding to the plurality of packet types in a plot 
ranging over the second time period in a second portion of the display area, wherein the plot 
includes a plurality of discrete selectable time periods; receiving a user selection of a range of 
the plurality of discrete selectable time periods; updating the graphical display to display 
statistics corresponding to the selected time periods. 

| 29. (Currently Amended) A method according to claim 3-4_further comprising the 

steps of: identifying packets belonging to a data stream; storing stream identification 
information as one of a separate record and a separate field in the records corresponding to the 
identified packets. 

30. (Original) A method according to claim 29 further comprising the step of recreating 
the data stream using the stored records and the stored stream identification information: 

| 31. (Currently Amended) A method according to claim 3-4_wherein 

the first communication line is in a network including a second communication line, 
step (d) inc l udes determ i n i ng o respective t i me value corresponding to o t i me when each 

of the se l ected packets was received ond the respective index associated with each selected 

packet includes te -said packet's respective time value, and 

step (c) inc l udes converting each of the se l ected packets into a respect i ve record wh i ch 

includes a uniquely identifiable portion of the respective selected packet; and 
the method further comprises the steps of: 
receiving second data from the second communication line; 
segregating the second data into packets; 

determining a respect i ve type of each pocket received from the second commun i cat i on 

line ; 

selecting packets received from the second communication line based on the i r a 
respective type of each packet : 

determining a respective time value corresponding to a time when each of the selected 
packets received from the second communication line was received; 

associating a respective index with each of the selected packets received from the 
second communication line, the respective index including the respective time 
valu c corrcspond i ng to a t i me when the packet was received from the second commun i cation 
line ; 

convert converting each of selected packets received from the second communication 
line into a respective record that includes a uniquely identifiable portion the selected packet 
| from the second communication line and includes 4ts -said packet's respective index; 

storing the records corresponding to the selected packets received from the second 
communication lin e i n a th i rd memory ; 

comparing the uniquely identifiable portions of packets received from the first 
communication line to the uniquely identifiable portions of packets received from the second 
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communication line i n records stored i n the memory to those i n records stored i n the third 
memory to determine which selected packets received from the first communication line 
correspond to packets received from the second communication line to generate matched pairs 
of packets; 

generating a transmission delay corresponding to each matched pair of packets using 
their respective indexes. 

32. (Original) The method according to claim 31 wherein the transmission delay for a 
particular matched packet is calculated based on a time of receipt of the matched packet on the 
first transmission line, a time of receipt of the matched packet on the second transmission line, 
a rate of data transmission on the first transmission line, and a length of the matched packet on 
the first transmission line. 

33. (Original) A method according to claim 32 wherein the first communication line 
transmits data using a first protocol and the second communication line transmits data using a 
second protocol different from the first protocol. 

34. (Original) A method according to claim 31 wherein the transmission delay is * 
generated at a level of accuracy less than 10 microseconds. 

35-63. (Canceled). > 

64-69. (Canceled). - ! 

70-71. (Canceled). 

72. (Canceled). 

73-77. (Canceled). 

78. (Currently Amended) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform method steps fet 
co ll ecting ond ana l yz i ng first data transmitted on o first communication l ine, soid method steps 
comprising: 

(a) receiving tbe-first data from the-a_first communication line; 

(b) segregating the rece i ved first data into packets; 
.(c) determin i ng a respective type of each packet; 

(d) select i ng packets based on the i r respective type; 

(c) assoc i ating a respect i ve index with each of the s elected pockets; 

(f) convert i ng each of the se l ected packets i nto a respective record inc l uding i ts 11 
respect i ve index; 

(g) stor i ng the records in a f i rst memory; 

(h) receiving a first duration value correspond i ng to a first time per i od; 

(ic) generating at l east one a_statistic corresponding to packets received during each of a 
plurality of successive first time period s, the first time periods having a first duration value ; and 

(jd) separately storing the generated statistics ot l east one stot i st i c for each of the 
plurality of successive first time per i od periods i n o second memory : and 

(e) generating a further statistic by aggregating the plurality of stored statistics . 

79. (Currently Amended) A method according to claim 34 _, further comprising 
selecting packets corresponding to communication sessions and step (c) comprises generating a 
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number of packets corresponding to unsuccessful communication sessions received during each 
successive first time period thc steps of: ( I ) se l ect i ng pockets correspond i ng to part i cu l ar 
commun i cot i on sessions; and (m) ident i fy i ng wh i ch of the pockets se l ected in stop (I) 
correspond to unsuccessful communication sess i ons . 

80. (Currently Amended) A method for processing data according to claim 79 wherein 
the respective type is packets corresponding to TCP sessions and the method : stop (0 
comprises selecting packets corresponding to TCP sessionsf and step (cm) comprises i dent i fying 
packets correspond i ng to unsuccessfu l TCP sessions; ond the method further comprise the step 
of: (n) generating a ratio of a quantity of unsuccessful TCP sessions to a quantity of total TCP 
sessions during a time period. 

81. (Currently Amended) A method according to claim 80 wherein i n step (m) the 
unsuccessful TCP sessions are identified to be those TCP sessions that were closed by other 
than a corresponding server. 

82. (New) A method according to claim 11 wherein the transmission delay corresponding 
to each packet is calculated using the equation 

transmission delay = (tsl-ts2)-(link_speed /packetjength) •• * 



where tsl and ts2 are the first and second times, respectively, the link_speed is a data 
rate on the first communication line, and the packetjength is the length of each respective 
packet on the first communication line. 

83. (New) A method according to claim 4 wherein the first communication line is in a 
network including a second communication line and the method further comprises correlating 
the packets received from the first communication line to packets received from the second 
communication line. 

84. (New) A method according to claim 31 further comprising the steps of: 
generating flow statistics based on the flow of data between the first and second 

communication lines; and 

routing further'data between the first and second communication lines based on the 
generated flow statistics. 

85. (New) A method according to claim 3 wherein the data is collected and analyzed 
by a host computer haying a network interface card coupled to the first communication line, the 
method further comprising the steps of: 

requesting an interface clock value from the network interface card; 
generating an adjusted interface clock value by subtracting a predetermined service time 
from the interface clock value; 

providing the adjusted interface clock value to the host computer; 
receiving a host clock value; and 

correlating the adjusted interface clock value with the host clock value. 

86. (New) A system for collecting and analyzing first data on a first communication 
line comprising: 
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means for receiving the first data from the first communication line; 
means for segregating the first data into packets; 

means for selecting packets based on a respective first characteristic of each packet; 
means for associating a respective index with each of the selected packets; 
means for converting each of the selected packets into a respective record including its 
respective index; 

means for storing the records; and 

means for generating a count based on a respective second characteristic of each of the 
selected packets received during each of a plurality of successive periods. 

87. (New) A system comprising: 

means for receiving first data from a first communication line; 
means for segregating the first data into packets; 

means for generating a statistic corresponding to packets received during each of a< 
plurality of successive first time periods, the first time periods having a first duration value; 

means for separately storing the generated statistics for each of the plurality of 
successive first time periods; and 

means for generating a further statistic by aggregating the plurality of stored statistics. 

88. (New) A system comprising: 

a network interface for receiving first data from a first communication line; 
a packetizer for extracting a plurality of packets from the first data; 
a memory; 

a processor for generating a first statistic corresponding to packets received during each 
of a plurality of successive first time periods, the first time periods having a first duration value, 
storing the generated statistics for each of the plurality of successive first time periods in the 
memory, and generating a second statistic by aggregating the plurality of stored statistics. 

89. (New) A system according to claim 88 comprising a display device for displaying 
at least one of the first and second statistics. 

90. (New) A system according to claim 88 comprising a user interface for receiving 
user input identifying at least one of the first statistics, the second statistics, and the first time 
period. 

91. (New) A system according to claim 88 comprising: 

a time source synchronized to an absolute time source; and 

a processor for determining a time when each respective one of the plurality of packets 
was received from the first communication line. 

92. (New) A system according to claim 91 wherein the time source is a receiver for 
receiving a time signal from a global positioning satellite. 
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